Calico Open Source vs Flannel

Calico Open Source provides networking, network security, and observability for Kubernetes across multi-cloud, hybrid-cloud, and on-premises environments. It supports container, virtual machine, and bare-metal workloads with a shared security policy framework. The policy engine implements Kubernetes network policy features including AdminNetworkPolicy and BaselineAdminNetworkPolicy. Policies can use tiers, deny and log actions, NetworkSets, and cluster-wide global rules; Staged Policies allow teams to assess behavior before applying enforcement. Listed data planes include eBPF, iptables, nftables, Windows, and VPP. Whisker provides a visual way to view flow logs and analyze network communication. Calico can also manage WireGuard tunnels to encrypt pod traffic between Kubernetes nodes. Calico Ingress Gateway provides traffic control, load balancing, and ingress policy enforcement. The free plan includes unlimited clusters, with in-memory data retention and community-driven support and maintenance. Tigera describes deployments ranging from 10 to 10,000 or more nodes.

Flannel is a free network fabric for containers designed for Kubernetes. A small flanneld agent on each host allocates a subnet lease from a configured address space, then forwards packets between hosts using a selected backend. Documented choices include VXLAN, host-gw, WireGuard and UDP, with VXLAN recommended. WireGuard encapsulates and encrypts packets using the in-kernel WireGuard implementation. Network configuration and subnet allocations can be stored in the Kubernetes API or directly in etcd. The project documents Kubernetes and Docker deployments, with Linux and Windows build instructions. Flannel does not enforce network policies itself, though its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it. It runs as a privileged daemonset with access to the host network, so the security policy advises least privilege and keeping it updated. Security fixes are maintained for the latest release only, and the backend documentation says not to change a selected backend at runtime.